InfoSecBulletin Cybersecurity for mankind
Chinese-speaking hackers have added Claude, Qwen, and DeepSeek to their hacking system to automate cyberattacks on governments and other targets in Asia, according to a report from the threat intelligence company Hunt.io.
Hunt.io says this operation is different from the campaign seen in July, where a Chinese-speaking operator used Claude Code and DeepSeek in attacks in four countries. The new campaign used AI models. It focused on Taiwan’s Kuomintang Party History Archives, Indonesia’s Ministry of Foreign Affairs, government and education in mainland China, and businesses in Da Nang, Vietnam.
Claude, DeepSeek, and Qwen AI agents combinedly used to hit gov.t across Asia
India: C-DOT Launches 14 Local Quantum-Safe Technologies
14,000 Dahua cameras compromised: TP-Link flaws enable RCE
Microsoft Reveals Project Zenith Windows PCs Able to Run 30B+ AI Models Locally
Google issues warning of new Chrome zero-day flaw exploited
CrowdStrike’s ‘FalconFlank’ zero-day allows SYSTEM privileges
727,000 data exposes: French hospital fined €500,000
153 Million Driver’s License Surfaced on Dark Web: FBI Starts Investigation
Google Unveils Gemini 3.8 Flash Cyber to Identify and Auto-Patch Security Flaws
SonicWall SMA1000 SSRF Hits 10, Exploiting CVE-2026-83548
Hunt.io found five open directories related to the campaign. They connected them using shared tools, like a SOCKS proxy endpoint found in different places. The systems had common SecFlow and GLUTTON items, shared accounts, and a direct link to the second-stage payload.
According to the researchers, a Fengtai District government environment was hit hardest, “where the operator achieved command execution, collected LSASS and registry hives, accessed government and health records, and deployed multiple Windows implants. Separate activity exposed a Chinese education AI platform and obtained root database access to a university campus-card system.”
The attackers accessed into a government Office Automation system that was open to the internet. They did this by using a file management tool that let them upload ASPX files and find web-accessible locations.
This let the hackers use tools on the server inside the app. They later moved a 75.8MB LSASS memory dump with important login details in 37 parts.
They got the SAM and SYSTEM registry files and set up a server page, extract.aspx, that looked for Windows password data. Then they found 822 OA account records and made a new active OA account with higher permissions. The OA storage had 949 attachments that added up to about 1.28GB.
Researchers found that the recovered material had government work and admin info, some health documents, a chronic disease report with patient details, and Windows login data.
